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[57] ABSTRACT 

A cable television converter with remotely modifiable 
functionality receives firmware downloaded over a 
cable television network. The integrity of the firmware 
is verified, and if valid, the firmware is executed to 
provide one or more converter functions. If the firm- 
ware is invalid, default operation software contained in 
ROM is executed instead of the firmware to return the . 
converter to baseline operation. In one embodiment, the 
converter includes a frequency agile data receiver to 
receive control instructions, on a first data channel and 
firmware on a second data channel. The receiver is 
forced back to the first channel if a successful firmware 
download does not occur on the second channel within 
a predetermined time period. The firmware is continu- 
ously transmitted in short segments, and the converter 
can continue to receive segments until all the segments 
of a designated firmware package have been success- 
fully downlbaded, unless the predetermined time limit 
expires sooner.** 
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tional operation of individual terminaJs on a multi-ter- 

FUNCTIONALLY MODIFLVBLE CABLE minal network. 

TELEVISION CONVERTER SYSTEM In cominonly owned U.S. Pat. No, 4JI2,239 to 

Frezza, et al. entitled "Security Arrangement for 

BACKGROUND OF THE INVENTION 5 i:>ownloadable Cable Television Converters", incorpo- 

^ . . , ui * 1 • • rated herein by reference, a downloadable converter is 

The present invention relates to cable television appa- ^^^^^^ ^^^^^^^ ^ ^^j^ ^^^^^ . ^^^^ 

ratus and more panicuiarly to a converter with re- downloaded. A false image could subject the system to 

moteiy modifiable functionality provided by download- ^^^^^ j^^^^^^y problems, such as enabling an unau- 

able firmware. . 10 thorized user to view premium programs. In the pa- 

As will be apparent from the following specification, dented system, a hooter image is received on one chan- 

the term "firmware" is used herein to describe func ^ checksum is computed therefrom. A valid 

tional operating software that is downloaded to a con- checksum, extracted from tag data transmitted on a 

verier or other device and stored m nonvolatile mem- separate channel and associated with a scrambled pro- 

ory. Until the downloaded "firmware" is changed, it 15 gram agnal, is compared with the computed checksum, 

resides in hardware (i.e., nonvolatile memory) just like if the checksums do not match, a descrambler in the 

conventional firmware. This concept of downloaded converter is precluded from descrambling the program 

"firmware" is intended to emphasize that the present signal. The system disclosed in this patent downloads ail 

invention provides modifiable functionality in systems of the operating software to a cable television converter 

that heretofore could not be modified due to their reli- 20 over a dedicated "booter channel", to which the con- 

anceon permanent firmware. - vertcr is force tuned when first turned on. After the 

Cable television converters are currently available download is complete, the converter's data receiver is 

that allow a cable system operator to remotely control returned to the regular data channel, where it reniains 

subscriber service authorizations from a central "hea- until the converte is turned off. 

dend" site. These units, which are commonly referred 25 It would {>e advantageous to provide: a method and 

to as "addressable converters", allow the caBle system system for downloading firmware to a remote terminal.^ 

operator to control access to various premium services such as a cable television converter, to allow modifica- 

by sending a control signal from the headend to individ- tion of virtually any or al! firmware functions of the 

ual converters located at subscribers' homes. The au- terminal by the system operator. It would be further 

thorization signals are carried on the cable television advantageous for such a method and system to enable 

system, and enable individual subscribers to view pro- ^^e system operator to replace or modify options thai 

grams that they pay an additional fee for. in operation, ^^^e predetermined at the time of manufacture or in- 

the control signals typically enable the converter to stallation of the terminal. By effecting terminal modifi- 

descramble the premium channels for- viewing by the P^^'o^s automatically from a headend location, such a 

subscriber method and system would eliminate the need for a tech- 

Other addressable systems currenUy available allow a "[^^^ '° » subscriber's home to modify or 

limited set of operational parameters to be downloaded Physically replace a subscriber s termmai to effect such 

to a converter from the headend. Such operational pa- functional modifications. " , 

rameters include, for example, information that maps ^ The present mveniion provides such a method and 

displayed channels.lo tuned channels, time-out periods, ^ ^y?!;^"^ for remotely modifying the functionality of a 

, , . i/v^i. ^ cable television converter or other termmaK 
barker channel(s), the converter output channel, the . 

terminal configuration, and enable/disable functions for SUMMARY OF THE INVENTION 

subscriber features such as remote hand-held control, . ^^e present invention, a cable 

parenta^ control, favonte channel recall, volume con- television converter with remotely modifiable function- 

trol andthehke.Thecurrentstateoftheartisiodown- provided. The converter includes means for 

load configuration information for a set of features that receiving firmware downloaded over a cable television 

have been predetenmned at the time of manufacture or ^^^^^j^^ receiving means for 

installation of the cable television converter^n exam- ^^^^ng the firmware. Means arc provided for verifying 

pie of such a converter is the Model pPV7200 address- 5^ integrity of the firmware, and processor means cou- 

able converter manufactured by the Jerrold Division of pj^d to the storing means accesses and executes the 

General Instrument Corporation, Hatboro, Penna., firmware to provide one or more converter functions 

U'S"'^* dictated by the firmware. Nonvolatile memory means 

Other systems with downloadable data capabilities are coupled to the processor means for storing default, 

are also known. U.S. Pat. No. 4,054,911 to Fletcher, et 55 operation software for the converter. Means responsive 

al. relates to an information retneval system capable of to the verifying means cause the processor means to 

capturing packets or rows of video displayable data execute the default operation software, instead of the 

and/or control program instraictions from data continu- downloaded firmware, in the event the integrity of the 

ously transmitted in a common predetermined format, . firmware is not verified. 

In the system disclosed in the patent, a user decides 60 Data receiving means may be provided for obtaining 
what information is to be retrieved, and takes action to instructions downloaded over a cable television net- 
cause a terminal to retrieve that information. Although work. Downloaded firmware is received and stored by 
a user can vary the function of the terminal by capturing the converter only in response to specific instructions 
different transmitted data, it is the user that determines received by the data receiving means, 
what video displayable information is to be received, 65 The firmware receiving means and data receiving 
and how the terminal which receives this information is means can comprise a frequency agile data receiver, 
to process it. There is no disclosure or provision of together with means for selectively tuning the receiver, - 
means to enable a system operator to establish the func- to receive instructions on a first channel and down- 



01/07/2004, EAST Version: 1.4.1 



5,003, 

3 

loaded finnware on a second channel. Timer means 
return the receiver to the first channel if the receiver 
has been tuned to the second channel for a predeter- 
mined time period. The predetermined time period may 
be specified in instructions received on said first chan- 5 
nel and the length of the time period may be dependent 
on an amount of firmware to be received. In this man- 
ner, a converter will not become stuck on the second 
channel by error, and be rendered unable to receive 
further instructions on the first channel. 1^ 

The downloaded firmware received and stored by 
the converter can implement a functional layout on a 
keyboard associated with the converter. Firmware can 
also implement a feedback function, such as an LED 
(light-emitting-diode) display or on-screen display to 
assist a user in operating the converter. A control func- 
tion for a video recorder coupled to the converter can • 
also be implemented by the firmware. Similarly, the 
finnware can implement a communication protocol for 
the converter, a descrambling technique for the con- 
verter, an bn-screen display to be provided by the con- 
verter to a television coupled thereto, and/or a user 
interface to services provided over the cable television 
network. 25 

In a preferred embodimenc of the present invention, * 
firmware- is transmitted in an encrypted form, and the 
instructions contain a key for decrypting the firmware. 
The firmware may also be received by the converter in 
a plurality of segments, with the instructions identifying 
the number of segments to be received for a complete 
firmware download. Means can be provided for deter- 
mining if all of the segments have been validly received, 
and for receiving replacement segments if one or more 
segments of the firmware have not been validly re- 35 
ceived. Receipt of firmware can be prevented if the 
number of segments identified by the instructions is 
greater than a predetermined limit. 

Cable television headend apparatus is provided for 
downloading firmware to an addressable, remotely 4Q 
modifiable cable television converter. Means are pro- 
vided for transmitting addressable converter data on a 
first data channel of a cable television network. Means 
are provided for transmitting firmware on a second data 
channel of the cable television network. An address 45 
specific to a particular converter is provided in the 
addressable converter data, which enables specific data 
to be received by the converter. Instructions are pro- 
vided in the specific data, to cause the converter to 
receive firmware transmitted on the second channel. 50 

The .cable television headend apparatus can further 
include means for verifying that firmware downloaded 
to the converter has been successfully received by the 
converter. Billing means maintain records of the cable 
television services each converter on the system is au- 55 
thorized to receive, and the various functions the con- 
verter is to have, and can assign a panicular firmware 
package to be downloaded to a particular converter on 
the basis of the functions specified for that converter. 

A method for providing a cable television converter 60 
with functions dictated by downloaded firmware is also 
provided. Converter control data is received from a 
remote location via a cable television network. A desig- 
nated firmware package is captured from a set of firm- 
ware packages carried on the cable television network, 65 
in response to instructions contained in the converter 
control data. The designated firmware package is stored 
in a memory provided in the convener, and is executed 
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to provide at least one converter function dictated 
thereby. 

The firmware packages may be carried on the cable 
television network in encrypted form, and decrypted 
using a key contained in the converter control data. In 
one embodiment, the converter control data is received 
on a first data channel and the firmware packages are 
captured from a second data channel on the cable televi- 
sion network. The first channel is monitored to receive 
converter control data, and the second channel is tuned 
to capture firmware upon receipt of appropriate instruc- 
tions on the first channel. Reception is returned to the 
first channel after the firmware is captured. If the firm- 
ware has not been captured within a predetermined 
time period, reception switches back to the first channel 
from the second channel. 

Also in accordance with the present invention, a 
remotely modifiable user terminal is provided which 
comprises means for receiving a plurality of cyclically 
transmitted firmware segments, the segments together 
comprising a firmware package. Means coupled to the 
receiving means verify each segment upon receipt 
thereof, and means are provided for storing each veri- 
fied segment. A determination is made as to whether a 
complete firmware package has been stored in the stor- 
ing means at the completion of a firmware transmission 
cycle. If not, then reception, verification, and storage of 
transmitted firmware segments continues during a sub- 
sequent firmware transmission cycle. Reception of the 
firmware segments is terminated upon a finding that a 
complete firmware package has been stored. Means can 
further be provided for precluding the execution of 
firmware segments until a complete firmware package 
has been stored. 

The verifying means can operate by testing a check- 
sum for each firmware segment as it is received. The 
terminal may further comprise means for maintaining a 
record of the proper checksum for each segment, and 
means for periodically retesting the checksums after a 
complete firmware package has been stored. Default 
operation software may be stored for the terminal, and 
executed if the checksums are not verified upon retest- 
ing. The complete firmware package may also be veri- 
fied after it has been stored, and the default opcrsftion 
software executed if the complete firmware package is 
not valid. The default operation software may also be 
executed if reception of firmware segments is not com- 
pleted during a predetermined time period. 

A complete firmware package may include a plural- 
ity of modules. Execution of fewer than all of the mod- 
ules may be precluded as an additional security feature. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram of a functionally modifiable 
cable television converter system in accordance with 
the present invention; 

FIG. 2 is a block diagram of the pertinent elements of 
a converter used in connection with the system' of the 
present invention; 

FIG. 3 is a fiowchan illustrating steps taken by the 
headend when it receives a new firmware package or an 
assignment to download firmware to a converter; 

FIG. 4 is a flowchart illustrating the continuous 
transmission of firmware over a secondary data chan- 
nel; 

FIG. 5 is a flowchart illustrating the steps taken by a 
converter in receiving downloaded firmware; and 
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FIG. 6 is a flowchart illustrating the periodic reverifi- 
cation of downloaded software by a converter. 

DETAILED DESCRIPTION OF THE 

INVErmON 5 

Turning to FIG. 1, a cable television system is de- 
picted having headend components, generally desig- 
nated 10 and subscriber components, generally desig- 
nated 12. The headend communicates with die sub- 
scriber via a distribution cable 36. A firmware develop- 10 
ment system 16 is used to create new functional firm- 
ware packages for subscriber terminals, such as con- 
verter 40. Firmware development system 16 may be 
physically located at the headend, but is more typically 
located at the facilities of a vendor which develops new 
firmware programs for sale to a cable system operator. 
New firmware packages may bfe transferred to an ad- 
dressable controller 14 located at the headend by mag- 
netic tape 20 which is read by addressable controller 14, 
or by communication between the firmware develop- 
ment system 16 and addressable controller 14 via direct 
connection or modems 18 operating over conventional 
telephone lines. Those skilled in the art will recognize 
that other means may also be available for. transferring 
firmware from firmware development system 16 to 
addressable controller 14. 

Once firmware is resident in addressable controller 
14, it is transmitted repeatedly over a data channel. The 
data channel may be either the primary addressable data 
channel provided in a conventional cable television 
network having addressable converters,, or a separate 
secondary data channel. In either event, the data chan- 
nel(s) can transmit . the data on an FSK modulated FM 
carrier or by any other suitable transmission scheme 
well known in the art. . 

The use of a secondary channel for downloading 
firmware to converters is illustrated in FIG. 1. Control 
signals, including data such, as convener addresses, 
program authorization codes, and the like is communi- 
cated from addressable controller 14. to a converter 40 
via control data modulator. 26. The output of control 
data modulator 26 is coupled to distribution cable 36 via 
a tap 34. and data is received therefrom by converter 40 
via tap 38. The control data modulator transmits the 
data signals on a primary channel, and in accordance 
with the present invention, the data includes instruc- 
tions to converter 40' which cause the converter' to 
receive specified firmware downloaded from address- 
able controller 14. 

In the two channel embodiment illustrated in FIG. 1, 
the firmware is transmitted on a secondary channel by 
firmware modulator 24, coupled to the cable network at 
tap 30. Upon receipt of instructions on the primary 
channel, converter 40 switches to the secondary chan- 
nel for receipt of designated firmware. An additional 
data path 28 may optionally b provided via tap 32 for 
receipt of data from converter 40 by addressable con- 
troller 14. Such data might include, for example, a veri- 
fication that converter 40 has successfully received a 
firmware package it has been instructed to receive. The 
provision of a return path 28, which provides a "two- 
way" cable communication system, is well known in the 
art. 

Billing system 22 is provided at the headend for main- 
taining accounting information /relating to charges in- 
curred by subscribers on the cable system. In accor- 
dance with the present invention, different firmware 
packages downloaded by headend 10 to convener 40 
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may provide different converter functions, with higher 
levels of service providing increased converter func- 
tionality. Billing system 22 keeps track of the level of 
service for each subscriber, and assigns particular firm- 
ware packages to subscriber converters on the basis of 
converter functionality to be provided to each sub- 
scriber. 

At the subscriber location 12, a subscriber may have 
one . or more video appliances 42, 44 coupled to the 
output of converter 40. For example, video appliance 42 
might be a television set, and video appliance 44 might 
be a video recorder ("VCR'*). In accordance with the 
present invention, firmware downloaded to converter 
40 can provide functions relating to a VCR. An exam- 
15 pie of such, a function is time controlled programming. 
This function enables the converter to be programmed 
to make channel changes at various times so that the 
VCR can record different television programs on differ- 
ent channels automatically and .while unattended. Such 
20 a function can also enable "impulse pay-per-view'* or- 
ders to be programmed into the converter by a sub- 
.scriber, so that special premium programs can .be or- 
dered, when the subscriber is not home, and recorded 
on the subscriber's VCR for later viewing. 
25 FIG. 2 is a block diagram illustrating the pertinent 
components in one embodiment of a converter 40 in 
accordance with the present invention. In the embodi- 
ment illustrated, the converter receives addressable data 
on one data channel and downloaded firmware on an- 
30 other data channel. It is noted that in another embodi- 
ment of the invention, both the addressable data and the 
firmware can be received over a single data channel. 
Or, the firmware may be carried on some other media, 
such as the public telephone network. 
35 In the two channel embodiment illustrated in FIG. 2, 
a microprocessor 50 receives data from cable 36 via a 
frequency agile receiver 52. A transmitter 61 and return 
path 62 can be provided from microprocessor 50 back 
to addressable controller 14 in the event the converter is 
40 used with a two-way cable television system. Like re- 
ceiver 52, transmitter 61 can be frequency agile to en- 
able a choice of return transmission frequencies. 

A tuner 54, under the control of microprocessor 50, 
tunes frequency agile receiver 52 to either a primary 
45 channel for receipt of addressable data (eg., instruc- 
tions to capture a particular firmware package) or to a 
secondary channel for the receipt of firmware. Al- 
though a single secondary channel is described herein 
for purposes of illustration, it will be appreciated that 
50 any number of such secondary channels can be pro- 
vided, depending on system requirements. Typically, 
frequency agile receiver will be tuned to the primary 
channel, and will only switch to the secondary channel 
upon specific instructions contained in data received on 
55 the first channel. In the alternate embodiment where 
both addressable data and firmware are received on a 
single data channel, frequency agile receiver 52 and 
timer 54 can be replaced with a fixed frequency data 
receiver. 

60 The provision of a dedicated secondary data channel 
as illustrated in FIG. 2 is advantageous. By keeping 
firmware data off of the primary channel, the data 
throughput load on this channel is reduced. 
In the two channel embodiment, firmware data is 
65 broadcast cyclically on the second channel, by address- 
able controller 14 at the headend. In a preferred em- 
bodiment, a plurality of different firmware packages are 
broadcast on the secondary channel, each package pro- 
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viding different converter functions or combinations of 
functions. Upon receipt of instructions on the primary 
channel, microprocessor 50 will cause tuner 54 to 
switch receiver 52 to the secondary channel for receipt 
of a designated firmware package. 

Various memory devices are coupled to microproces- 
sor 50, including read onJy memory ("ROM*') 56, oper- 
ating random access memory ("RAM") 58, and nonvol- 
atile firmware RAM 60. ROM 56 contains a program 
that allows converter 40 to retrieve and execute a 
downloaded firmware package. Upon receiving the 
proper command from the addressable controller, the 
converter aborts any downloaded package currently 
being executed, accesses the appropriate data channel 
for receipt of a designated firmware package to be 
downloaded, and receives and loads the firmware into 
nonvolatile firmware RAM 60. 

ROM 56 also contains default operation software, 
which is used to restore the converter to a nominal or 
"baseline" operation if a bad firmware download oc- 
curs. As explained below, if an error is detected in the 
receipt of downloaded firmware, or if the .firmware is 
found to be invalid, the converter is forced to execute 
only the default operation software stored in ROM 56. 

A timer 64 is associated with microprocessor 50 to 25 
provide a time-out feature that prevents the converter 
from getting stuck on the secondary channel, in the 
event there is a problem receiving specified firmware. 

When billing system 22 assigns a new firmware* pack- 
age to a particular converter 40, addressable controller 
14 is commanded to transmit instructions to the con- 
verter. The instructions are received by microprocessor 
50, and include an identifier specifying which firmware 
package to receive, where to find the firmware package 
(i.e., on the primary or a specified secondary channel), 
a predetermined time limit defining how long the con- 
verter should attempt to receive the firmware before 
aborting, a key to use in decrypting jhe data in the event 
it is encrypted, and the maximum segment number to be 
loaded (indicating how many segments are included in 40 
the firmware package to be received). While the firm- 
ware is being received, timer 64 counts down the time- 
out period specified in the download command. If the 
timer expires, microprocessor 50 aborts the download. 
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operations. Pressing a button on the converter, or its 
remote control unit, can cause an LED to light, verify- 
ing that the button has been pressed or that a function to 
be activated by the button has occurred. Such a feed- 
back function is useful to assist a user in operating the 
converter. 

The converter also includes a keyboard 68, the func- 
tional layout of which can be defined and/or modified 
by firmware downloaded to the converter. Keyboard 
68 may be physically on the converter box, on a remote 
hand-held unit for the converter, or a separate keyboard 
can be provided in both places. 

Converter 40 also includes a descramblcr 70 for de- 
scrambling premium programs received via the cable 
television network. Various descrambling techniques 
are well known in the art, and different techniques can 
be implemented by downloading different firmware to 
the converter. 

Another feature that can be provided by converter 40 
is the display of information on a user's television set. 
On-screen display driver 72 is provided for this pur- 
pose. An example of such a display is the channel num- 
ber tuned to, or the current time. In addition, on-screen 
displays can be used to distribute messages from the 
cable system operator, e.g., "your account is past due: 
please send us a check". An electronic mail, or "E-mail" 
feature can also be provided, enabling a subscriber to 
send and receive text messages on his television (or 
other display) via the cable system. The implementation 
and/or modification of on-screen displays can be pro- 
vided by firmware downloaded to the converter. 

In order to provide a measure of protection against 
illegal use of the firmware download feature, the firm- 
ware is downloaded to the converter in an encrypted 
form. The data is decrypted at the converter by a de- 
cryption module 74. A decryption key is transmitted lo 
the converter from the headend as part of the address- 
able data instructions that command the converter to 
receive a particular firmware package. Encryption and 
decryption schemes are well known in the art. Exarri- 
ples of such schemes are provided in commonly ou ned 
U.S. Pat. No. 4,638,356 of William A. Frezza, entiiicd 
"Apparatus and Method for Restricting Access to a 



and returns to the original data channel. The time-out 45 Communication Network", and U.S. Pat. No. 4.710.955 



period specified in the download command can be var- 
ied depending on the amount of firmware to be down- 
loaded. 

Timer 64 is also used in connection with a self-check 
that is periodically performed by the converter to en- 30 
sure that the firmware has not changed since the last 
authorized download. This self-check is a security fea- 
ture to guard against infiltration of the converter by a 
"software pirate" who attempts to download unautho- 
rized software to the converter, in an effort to steal 55 
services from the cable system. 

In accordance with the self-check procedure, timer 
64 retests the checksum for each of the firmware seg- 
ments at regular intervals after the firmware has been 
downloaded. In the event a checksum is found to be 60 
invalid, microprocessor 50 restores the converter to 
baseline operation by executing the default operation 
software contained in ROM 56. 

Converter 40 contains various other components 
with functions that can be modified by downloaded 65 
firmware. For example, a light-emitting-diode ("LED") 
display or other display 66 may be provided on the 
converter to give a user feedback concerning converter 



of Marc W. Kauffman, entitled "Cable Television Svn- 
tem with Two- Way Telephone Communication Paih*'. 
Both of these patents are incorporated herein by refer- 
ence. 

A viewership monitor 76 can be provided in accor- 
dance with the present invention to enable a cable sys- 
tem operator to determine what programs and services 
a subscriber has received using each converter, and/or 
to retrieve a list of the functions which have been used 
on each converter. Viewership monitor 76 will monitor 
the operation of the converter, and store pertinent data 
relating thereto. By addressing an appropriate com- 
mand to the converter, the cable system operator will 
be able to upload the data to the headend for analysis. 

Other functions that can be implemented by firmware 
downloaded to the converter include communication 
protocols for the converter, and user interfaces to ser- 
vices provided over the cable television network. For 
example, a user may be provided with the capability to 
order pay-per-view programs on an impulse basis. The 
procedure for ordering such programs can be modified 
through downloadable firmware. Utility meter reading 
can also be provided, by adding an asynchronous data 
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port to the converter -and controlling the retrieval of 
utility data via downloaded firmware. 

A flowchan illustrating a routine which can be used 
by the addressable controller in. connection with the 
receipt and downloading of firmware is provided in 5 
FIG- 3. The routine begins at box 80, and at box 82 a 
determination is made as to whether a firmware update 
has been received from the firmware development sys- 
tem. If so, control passes to box 84 and the new firm- 
ware data is encrypted. At box 86, the encrypted data is 10 
loaded into the secondary data channel transmitter 
(firmware modulator 24) and continuously transmitted 
on the secondary channel together with other firmware 
packages that can be provided to conveners on the 
system. . 15 

At box 88, a determination is made as to whether a 
.new firmware package assignment has been made by 
billing system 22. If so, addressable controller 14 sends 
an appropriate command on the primary channel (con- 
trol data modulator 26) as. indicated at box 90. The 20 
command is addressed to the particular converter that is 
to receive the firmware, and identifies the channel the 
firmware is to be received from, identifies the firmware 
package to be received, provides the. decryption key 
necessary to decrypt the firmware data, identifies the 25 
number of segments which make up the coipplete firm- 
ware package, and sets forth the time-out parameter 
defining the maximum time the converter should stay 
tuned to the secondary channel for receipt of the down- ' 
loaded firmware, 30 

The converter receives the firmware in fixed length 
"segments", and specific converter models will have 
specific maximum segment numbers determining the. 
actual maximum size of allowable firmware downloads. 
In a preferred embodiment, the maximum segment num- 35 
ber is a hard-coded parameter. Should an attempt be 
made to download firmware that exceeds the maximum 
size, the download will be rejected by the converter. In 
operation, the converter will ignore the download com- 
mand and will not switch to the secondary channel if 40 
the transmitted maximum segment number parameter . 
exceeds the internal converter maximum. 

At box 92 of FIG. 3, a determination is made as to 
whether an abort of a download is required. This would^ 
be the case, for example, if the addressable controller 45 
delects, a problem with an attempted download. In the 
event an abort is required, an abort command is trans- 
mitted over the secondary channel as indicated at box 
94. The converter will then switch back to the primary 
channel, execute the default operation software to re- 50 
turn to a baseline operation, and await a subsequent 
command from the addressable controller via the pri- 
mary data chaimel. At box 96, the routine of FIG. 3 
ends. It will be appreciated by those skilled in the art 
that the routine of FIG. 3 is called on a periodic basis. 55 
(or can be a continuous loop) to enable new firmware to 
be received from the firmware development system and 
to download firmware packages to converters at the 
command of billing system 22. . 

FIG. 4 illustrates a routine that the addressable con- 60 
troller can use to continuously transmit firmware data 
over the secondary channel. The routine commences at 
box 100, and at box 102 data is transmitted over the 
secondary channel. At box 104, a determination is made 
as to whether the last segment of a firmware package 65 
has been transmitted. If not. transmission of the remain- 
ing segments continues as indicated at box 102. Once 
the last segment has been transmitted, control passes to 



10 



box 106 and the addressable controller transmits a 
check/execute command to the converter(s) that was to 
receive the firmware package. The check/execute com- 
mand includes the firmware package number that was 
to be received, and a check pattern. The check pattern 
is used to verify the entire download prior to execution. 
When a check/execute command is received, the con- 
verter checks to see if all required segments have been 
received, and that the check pattern downloaded 
matches the pattern calculated from the actual down- 
loaded data. If all checks are valid, the' converter per- 
mits execution of the downloaded code, and returns to 
the primary data channel. After the check/execute 
command is sent at box 106 of FIG. 4, control returns to 
box 102, and continuous transmission of the data pro- 
ceeds over the secondary channel. 

FIG, 5 is a flowchan illustrating .the capture of down- 
loaded firmware by a converter. The routine begins at 
box 110, and control passes to box 112 where a determi- 
nation is made as to whether a firmware capture com- 
mand has been sent to the converter. If not, the con- 
vener continuously waits for such a command to be , 
received at box 112. 

Once a firmware capture command Is received, con- 
trol passes from box 112 to box 120 for the actual cap- 
ture of the firmware. At the same time, an ancillary 
time-out process commences as indicated at boxes 114. 
116, and 118, A timer counts down the time-out period 
specified in the firmware capture command. If the: time- 
out period expires before the specified firmware pack- 
age has been successfully captured, as determined at 
box 114, c6ntrol passes to box 116 where the download 
is aborted and the converter returns to the primary data 
channel. As indicated at box 118, the default operation 
software is executed so that the converter can operate in 
a baseline mode until the appropriate firmware package 
can be properly downloaded. 

As indicated at box 120, before a firmware download 
commences, a determmaiion is made as to whether the 
number of segments contained in the firmware package 
to be downloaded is within bounds. In other words, as 
noted above, the maximum segment number of the firm- 
ware package to be downloaded must not exceed the 
maximum size allowable for the converter. If the num- 
ber of segments exceeds the number allowed by the 
converter* the firmware capture command is ignored 
and control returns to box 112. Otherwise, the firmware 
capture proceeds and at box 122, the converter switches 
to the secondary channel (i.e., the channel on which the 
firmware is downloaded). At. box 124. the segments 
comprising the firmware package are received- Firm- 
ware is continuously broadcast on the secondary data 
channel in small (e.g.. 32 byte) encrypted packets. A 
converter that has been commanded to accept a new 
package tunes to the appropriate channel and loads each, 
packet that has the proper version identifier. While 
loading, the converter keeps track of each segment 
successfully loaded in an interna! segment bit map. As 
indicated at box 126, a determination is made as to 
whether a segment has been successfully loaded. This is 
accomplished by computing a checksum for each seg- 
ment, and comparing the checksum with one down- 
loaded with the firmware segment. If the checksums 
match, the converter decrypts the data contained in the 
segment, stores the data, and sets an appropriate bit in a 
firmware segment bit map as indicated at box 130. In 
storing the data, if prior firmware has been stored in the 
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converter/the appropriate segment of the prior firm- 
ware is overwritten with the newly received data- 

If it is determined at box 126 that a segment has not 
been properly loaded (i.e., the computed and down- 
loaded checksums do not match)» the convener ignores 5 
the segment and proceeds directly to box 132. At box 
132, a determination is made as to whether the last 
segment in a firmware package has been received. If 
not, control returns to box 124 and the procedure con- 
tinues until all segments are received. 10 

After the last segment has been received, control 
passes to box t34 which determines if the bit map cre- 
ated at box 130 is complete. If the bit map is not com- 
plete, it means that one or more segments were not 
properly loaded and an attempt to receive these scg- 15 
ments will be made during the next transmission cycle 
of the firmware. In this event, control returns from box 
132 to box 124 where an attempt to receive the entire 
firmware package will again be made. 

As is evident from the flowchart of FIG. 5, an incor- 20 
rectly received segment will not overwrite a previously 
correctly received segment. All correctly received seg- 
ments, however, will overwrite previously received 
segments. In this manner, even -if there are errors in the 
transmission of certain segments during a download 25 
cycle, all of the" segments sliould be correctly received 
after the completion of several complete transmission 
cycles of a firmware package. 

Once all of the segments have been properly re- 
ceived, the bit map will be complete, and box 134 will 30 
pass control to box 136. Box 136 responds to the check- 
/execute command transmitted by the addressable con^ 
troUer at box 106 in FIG. 4. When the check/execute 
command is received, the converter checks to see if all 
required segments have been received and that the 35 
check pattern downloaded matches a pattern calculated 
from the actual downloaded data (i.e., the complete 
firmware package). If the patterns do not match, con- 
trol returns to box 124 and additional attempts are made 
to receive the firmware as long as a time-out (box 114) 40 
has not occurred. 

• If the entire firmware package is determined to be - 
valid at box 136, control passes to box 138 and an execu- 
tion bit is set permitting the firmware to be executed. As 
an additional level of protection against a software pi- 45 
rate, software contained in the converter's ROM (ROM 
56 — FIG. 2) can periodically determine if all of the 
functional modules contained in the firmware package 
are being executed, and if not, subsequent execution of 
the firmware can be precluded by turning off a separate, 50 
special execution bit maintained by the converter. 

At box 140, the downloading of a firmware package 
is complete, and the converter returns to the primary 
data channel. The routine ends at box 142. 

The firmware download process is a destructive one. 55 
Once a converter receives the command to Accept a 
new package, the old downloaded firmware (if any) is 
effectively deleted and cannot be executed. In the pre- 
ferred embodiment, partial downloads are not sup- 
ported, and an entire package must be sent. This further 60 
frustrates a software pirate's efforts, and allows a firm- 
ware download to be nullified by sending the command 
to accept a package immediately followed by sending 
the command to return to the primary data channel. 

The various commands sent by the addressable con- 65 
troUer to support the firmware download process arc: 

Accept Firmware Download 



Return to Primary Channel 
Disallow Downloaded Execution 
Load Firmware Segment 
Check/Execute Firmware 
Send Firmware Check Pattern 

The "Accept Firmware Download" command is 
used to initiate the firmware download process. It may 
be sent to one individual converter or globally to a set 
of converters that understand a group address. The 
addressed converter(s) prepares to accept the package 
number, on the appropriate channel, using the given 
firmware decryption key and maximum segment num- 
ber. The firmware download time-out value is also 
given. Upon reception of this command, the converter 
goes into its firmware download mode, in which it must 
not execute any downloaded code. 

The "Return to Primary Channel" command is used 
to force a converter to return to the primary data chan- 
nel. This command may also be sent in a specific format 
to an individual converter, or in group format to a set of 
converters. All converters receiving this command 
abort the current firmware download, cJear their firm- 
ware segment bit maps, and exit the firmware download 
mode. 

The **DisaIlow Downloaded Execution" command 
explicitly disallows the execution of any downloaded 
firmware. It may be sent in the specific or group format. 
All converters receiving this command abort execution 
of any downloaded firmware, clear their firmware seg- 
ment bit maps, exit firmware download mode, and exe- 
cute the default operation software contained in ROM 
for baseline operation. Another method of prohibiting 
downloaded firmware from being executed is to send an 
"Accept Firmware Download" command immediately 
followed by a "Return to Primary Channel'* command. 

The "Load Firmware Segment" command is used to 
download the individual segments of a firmware pack- 
age. All converters receiving this command, if in firm- 
ware reception mode, overwrite the appropriate seg- 
ment of firmware by the received data. Before actually 
overwriring the code, the converter checks to see if the 
package number matches the commanded package 
number, and calculates the segment check pattern from 
the received data. If the check pattern is correct, the 
segment data is decrypted, the appropriate prior seg- 
ment is overwritten with the new segment, and the 
appropriate bit in the firmware segment bit map is set. 

The "Check/Execute Firmware" command is used 
to terminate the firmware download process. All con- 
verters receiving this command respond only if the 
package number matches the one sent originally in the 
"Accept Firmware Download" command, and if in 
firmware reception mode. If so, the converter checks to 
see if all of the necessary segments of firmware have 
been correctly received. If they have been, the package 
check pattern is calculated and tested. If the check 
pattern is bad, the converter ignores the command. If 
the check pattern is good, the converter permits execu- 
tion of the newiy downloaded package, switches back 
to the primary data stream, exits the firmware down- 
load mode, and clears its firmware download segment 
bit map. 

The "Send Firmware Check Pattern" command is 
used to verify the firmware download process. A con- 
verter receiving this command responds only if it is not 
in firmware reception mode. In this event, the converter 
reports the check pattern of the appropriate segment or 
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of the entire package. This verification scheme is only 
available on a two-way cable system. 

FIG. 6 illustrates a periodic self-check routine used 
by the convener to test the validity of downloaded 
firmware to ensure that it has not changed since the last 5 
download. This self-check is performed by the con- 
verter itself, and no addressable controller command is 
required to initiate it. The routine begins at box 150, At 
box 152, a clock runs to keep track of time. At box 154, 
a determination is made as to whether a predetermined 10 
tinie interval has passed. If not, the routine loops back 
to box 152 and the process continues until the time 
interval has run. Then, box 154 passes control to box 
156 to commence the periodic self-check. 

At box 156, the first segment of the firmware package 15 
is tested by computing its checksum. At box 158, a 
determination is made as to whether the checksum is the 
proper checksum for that segment. If not, control passes 
to box 160 and the default operation software is exe- 
cuted to return the convener to baseline operation. If 20 
the checksum for the segment is proper, control passes 
to box 162, which determines if the segment just tested 
is the last segment in the firmware package. If not, the 
routine loops back to box 156 so that all of the segments 
in the firmware package can be tested. 25 

Once the last segment has been tested, control is 
passed from box 162 to box 164 where the clock is reset. 
Control then loops back to box 152 and = the process 
continues, so that the self-check will be periodically 
perfonned at the time interval dictated by the time-out 30 
determination function at box 154. 

It will now be appreciated that the present invention 
provi^les a method and apparatus for remotely modify- 
ing the functionality of a terminal, such as a cable televi- 
sion converter. Terminal functions are dictated by 35 
downloaded, firmware. The firmware is transmitted in 
small segments to reduce the likelihood and severity of 
transmission errors, and to reduce the temporary buffer- 
ing requirements within the terminal. Each section of a 
firmware package is transmitted with an identifier indi- 40 
eating which segment it is, and which firmware package 
it is part of. A multiplicity of firmware packages may be 
carried on a single system, with different terminals in 
the system accepting and executing different packages 
as specified by the system headend. 45 

The firmware is stored at the tenninal in nonvolatile 
memory, such as RAM with a battery backup. Various 
safeguards are provided to ensiu-e that the firmware is 
accurately downloaded, and to frustrate the efforts of a 
software pirate attempting to infiltrate the system. 50 

Although the present invention has been described in 
connection with a preferred embodiment, it will be 
appreciated that man modifications and adaptations 
may be made thereto without departing from the spirit 
and scope of the invention as set forth in the following 55 
claims. 

What is claimed is: 

1. A cable television converter with remotely modifi- 
able functionality comprising: 

means for receiving firmware downloaded from a 60 

cable television headend; 
means coupled to said receiving means for storing 

said firmware; 
means for verifying the integrity of said firmware; 
processor means coupled to said storing means for 65 

accessing and executing said firmware to provide 

one or more converter functions dictated by the 

firmware; 



nonvolatile memory means coupled to said processor 
means for storing default operation software for 
said converter; and 

means responsive to said verifying means for causing 
said processor means to execute said default opera- 
rion software instead of said firmware in the event 
the integrity of said firmware is not verified. 

2. The converter of claim 1 further comprising: 
data receiving means for obtaining instructions 

downloaded from a cable television headend; and 
means for enabling downloaded firmware to be re- 
ceived and stored by the converter only in re- 
sponse to specific instructions received by said data 
receiving means. 

3. The converter of claim 2 wherein said firmware 
receiving means and data receiving means comprise: 

a frequency agile data receiver; and 

means for selectively tuning said receiver to receive 
said instructions on a first channel and said firm- 
ware on a second channel, 

4. The converter of claim 3 further comprising: 
timer means for returning said receiver to said first 

channel if it has been tuned to said second channel 
for a predetermined time period. 

5. The converter of claim 4 wherein said predeter- 
mined time period is specified in instructions received 
on said first channel. 

6. The converter of claim 5 wherein the length of said 
predetermined time period is dependent on an amount 
of firmware to be received. 

7. The converter of claim 2 wherein said firmware is 
transmitted in an encrypted form, and said instructions 
contain a key for decrypting the firmware. 

8. The converter of claim 2 wherein said firmware is 
received in a plurality of segments, and said instructions 
identify the number of segments to be received for a 
complete firmware download. 

9. The converter of claim 8 further comprising: 
means for determining if all of said segments have 

been validly received; and 
means for receiving replacement segments if one or 
more segments of said firmware has not been val- 
idly received. 

10. The converter of claim 8 further comprising: 
means for preventing the receipt of firmware if the 

number of segments identified by said instructions 
is greater than a predetermined limit. 

11. .The converter of claim 1 wherein said firmware 
implements a. functional layout on a keyboard associ- 
ated with said converter. 

12. The converter of claim 1 wherein said firmware 
implements a feedback function to assist a user in oper- 
ating the converter. 

13. The converter of claim 1 wherein said firmware 
implements a control function for a video recorder 
coupled to the converter. 

14. The converter of claim 1 wherein said firmware 
implements a communication protocol for the con- 
verter. 

15. The converter of claim 1 wherein said firmware 
implements a descrambling technique for the converter. 

16. The converter of claim 1 wherein said firmware 
implements an on-screen display to be provided by the 
converter to a television coupled thereto. 

17. The converter of claim 1 wherein said firmware 
implements a user interface to services provided over a 
cable television network. 
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18. The converter of claim 1 wherein said firmware 
implements an electronic mail capability to be provided 
over a cable television network. 

19. The converter of claim 1 wherein said firmware 
implements a viewership monitoring function. 5 

20. A cable television converter with remotely modi- 
fiable functionality comprising: 

frequency agile data receiver means for receipt of 
addressable data from a cable television headend 
on a first channel and for receipt of firmware from 10 
said headend on a second channel; 

means for tuning said receiver means to switch to said 
second channel for receipt of firmware in response 
to instructions contained in addressable data re- 
ceived on said first channel; 15 

memory means for storing firmware received on said 
second channel; and 

processor means coupled to said memory means for 
accessing and executing firmware received from 
said headend to provide at least one converter 20 
function. 

21. The converter of claim 20 further comprising: 
means for verifying the integrity of firmware re- 
ceived on said second channel; and 

means for causing said processor means to execute 25 
default operation software instead of said firmware 
in the event the integrity of said firmware is not. 
verified. 

22. The converter of claim 20 further comprising: 
timer means for returning said receiver to said first. 30 

channel if it has been tuned to said second channel 
for a predetermined time period. 

23. The converter of claim 22 wherein said predeter- 
mined time period is specified in instructions contained 

in addressable data received on said first channel. 35 

24. The converter of claim 23 wherein the length of 
said predetermined time period is dependent on the 
amount of firmware to be received. 

25. The converter of claim 20 wherein said firmware 
implements a functional layout on a keyboard associ- 40 
ated with said converter. 

26. The converter of claim 20 wherein said firmware 
implements a feedback function to assist a user in oper- 
ating the converter. 

27. The converter of claim 20 wherein said firmware 45 
implements a control function for a video recorder 
coupled to the converter. 

28. The converter of claim 20 wherein said firmware 
implements a communication protocol for the - con- 
verter. 50 

29. The converter of claim 20 wherein said firmware 
implements a descrambling technique for the converter. 

30. The converter of claim 20 wherein said firmware 
implements an on-screen display to be provided by the 
converter to a television coupled thereto. 55 

31. The converter of claim 20 wherein said firmware 
implements a user interface to services provided over a- 
cable television network. 

32. The converter of claim 20 wherein said firmware 
implements an electronic mail capability to be provided 60 
over a cable television network. 

33. The converter of claim 20 wherein said firmware 
implements a viewership monitoring function. 

34. Cable television headend apparatus for download- 
ing firmware to an addressable remotely modifiable 65 
cable television converter, comprising: 

means for transmitting addressable converter data on 
a first data channel of a cable television network; 



means for transmitting firmware on a second data 
channel of said cable television network; 

means for providing an address in said addressable 
converter data specific to a particular converter 
coupled to the network, said address enabling spe- 
cific data to be received by said converter on said 
first data channel; and 

means for providing instructions in said specific data, 
said instructions causing said converter to switch 
to said second channel to receive firmware. 

35. The apparatus of claim 34 further comprising: 
means for verifying that firmware downloaded to 

said converter has been successfully received by 
the converter. 

36. The apparatus of claim 34 further comprising; 
billing means for maintaining a record of functions 

said converter is authorized to have, and for assign- 
ing a particular firmware package to be down- 
loaded to said converter on the basis of the autho- 
rized functions. 

37. A method for providing a cable television con- 
verter with functions dictated by downloaded firm- 
ware, comprising the steps of: 

receiving converter control data from a remote hea- 
dend location; 

capturing a designated firmware package, from a set 
of different firmware packages dictating various 
converter functions and transmitted from said re- 
mote headend location, in response to instruct ions 
contained in said converter control data; 

storing the designated firmware package in a memory 
provided in said converter; and 

executing said firmware to provide at least one con- 
verter function dictated thereby. 

38. The method of claim 37 wherein the firmware 
packages are transmitted in encrypted form, said 
method comprising the further step of: 

decrypting the captured firmware using a key con- 
tained in said converter control data. 

39. The method of claim 37 wherein said convener- 
control data is received on a first channel of a cable 
television network and said firmware packages a re, cap- 
tured from a second channel of the cable television 
network. 

40. The method of claim 39 comprising the further 
steps of: 

monitoring said first channel to receive converter 
control data; 

switching to said second channel to capture firmware 
upon receipt of appropriate instructions on said 
first channel; and 

switching back to said first channel after said firm- 
ware is captured. 

41. The method of claim 40 comprising the further 
step of: 

switching back to said first channel from said second 
channel upon the expiration of a predetermined 
time period, if the firmware has not been captured 
within said time period. 

42. The method of claim 41 comprising the further 
step of: 

deriving said time period from converter control data 
received on said first channel. 

43. The method of claim 42 wherein the length of the 
time period is dependent on the amount of firmware to 
be captured. 

44. A remotely modifiable user terminal comprising: 
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means for receiving a plurality of cyclically transmit- 
ted firmware segments together comprising a firm- 
ware package; 

means coupled to said- receiving means for verifying 
each segment upon receipt thereof; ' 

means responsive to said verifying means for storing 
each verified segment; 

means for determining if a complete firmware pack- 
age has been stored in said storing means at the 
completion of a firmware transmission cycle; 

means responsive to said determining means for con- 
tinuing: to receive, verify, and store transmitted 
firmware segments during a subsequent firmware 
transmission cycle if said determining means finds 
that a complete firmware package has not been 
stored; and 

means for terminating the reception of firmware seg- 
ments upon a finding by said determining means 
that a complete firmware package has been stored. 20 

45. The terminal of claim 44 further comprising: 
means for precluding the execution of firmware seg- 
ments until a complete firmware package has been 
stored. 

46. The terminal of claim 44 wherein said verifying 25 
means tests a checksum for each firmware segment, said 
terminal further comprising: 

means for maintaining a record of the proper check- 
sum for each segment; and 

means for periodically retesting said checksums after 30 
a complete firmware package has been stored. 

47. The terminal of claim 46 further comprising: 



means for storing default operation software for said 
terminal; and 

means for executing said default operation software if 
said checksums are not verified upon retesting. 

48. The terminal of claim 44 further comprising; 

means for validating the complete firmware package 
after it has been stored. 
. 49. The terminal of claim 48 further comprising: 

means for storing default operation software for said 
terminal; and 

means for executing said default operation software if 
said validating means determines that the complete 
firmware package is not valid. 

50. The terminal of claim 44 further comprising: 
timer means for terminating the reception of firm- 
ware segments after a predetermined time period. 

51. The terminal of claim 50 further comprising: 
means for storing default operation software for said 

terminal; and 

means for executing said default operation software if 
said timer means terminates the reception of firm- 
ware segments. 

52. The terminal of claim 44 wherein said terminal is 
a cable television converter, and the execution of said 
firmware provides at least one converter function. 

53. The terminal of claim 52 wherein a complete 
firmware package includes a plurality of modules, said 
terminal further comprising: 

means for precluding the execution of downloaded 
firmware if fewer than all of the modules are avail- 
able for execution. : 
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